9e6d8dd4e3
sendmsg/recvmsg with SCM_RIGHTS. Item 1 of docs/plan/foundations.md and
mechanism 1 of docs/plan/hybrid.md, which are the same primitive seen from two
directions: Wayland's wl_shm_create_pool passes a file descriptor with no
integer-shaped alternative, and handing a driver process the device it is
allowed to touch is the same act. Both plans stopped here.
Linux's structures byte for byte -- msghdr, cmsghdr, the CMSG_ macros -- because
the programs that need this are not ours. libwayland and toybox both call
recvmsg with Linux's headers and would not notice a friendlier door.
The delivery rule is the whole design. A batch of descriptors is pinned to the
stream position of the first byte of the message that carried it, and that has
two halves: a reader arriving at that position is handed them, and a reader that
has not reached it is stopped SHORT of it. Leave out the second half and a
program asking for 4096 bytes swallows three messages and is handed one
message's descriptors, with nothing in the result saying which. socktest checks
exactly that: two one-byte messages, an eight-byte read, one byte back.
The kernel holds a reference to every descriptor in flight, so a sender may
close its own copy the moment sendmsg returns. Giving that reference back is the
part that leaks if it is not written down, and there are three ways a message
ends:
- received with room installed in the receiver's table
- received without room, or by
plain read(2) closed; MSG_CTRUNC for the first case
- never received, socket closed closed by sockclose
The middle row looks like a choice and is not: holding kernel references for a
receiver that has proved it is not looking is a leak with extra steps.
No garbage collector. A socket descriptor sent over that same socket and never
received holds a reference to the socket that holds the reference to it, and
neither close reaches zero. Linux carries several hundred lines for this.
Nothing on either plan passes a socket over a socket -- Wayland passes memory,
the driver work passes devices -- so it is a bounded leak that is documented
rather than a silent one.
Fourteen checks in cmd/socktest, and every one moves data through the descriptor
rather than inspecting it. The descriptor passed is always a pipe end, because a
pipe announces its own lifetime: a read of a pipe whose writers are all gone
returns 0, which turns "was the kernel's reference released" -- otherwise
invisible from userspace -- into a value a test can compare.
Two bugs fell out, neither in the new code:
- sockpair() never set the socket's domain, so every socketpair() socket
claimed domain 0. Invisible while the data paths asked only whether a socket
was AF_INET or AF_NETLINK, since zero answers "neither" correctly.
SCM_RIGHTS asks "is this AF_UNIX", and zero is wrong for that one.
- pipe_poll() reports POLLHUP but not POLLIN at end of file, so a non-blocking
read of a pipe whose writers had all gone returned EAGAIN forever instead of
0 -- a program that polls and reads spins waiting for an end that already
happened. sockreadable() always had the equivalent condition; the pipe path
did not. Found because the test helper for "is this descriptor closed" is a
non-blocking read of a pipe.
projects/schcom/README.md said SCM_RIGHTS was done for a long time while nothing
in the kernel implemented it, and an entire GUI plan was drawn on that line.
It is true now, which is not the same as it having been right, and the README
says so.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
160 lines
No EOL
5.4 KiB
C
160 lines
No EOL
5.4 KiB
C
#pragma once
|
|
#ifndef USER_H
|
|
#define USER_H
|
|
|
|
#include "types.h"
|
|
#include "date.h"
|
|
|
|
struct stat;
|
|
struct rtcdate;
|
|
struct mouse_data;
|
|
|
|
// --- system calls ---
|
|
int fork(void);
|
|
void exit(void) __attribute__((noreturn));
|
|
int wait(void);
|
|
int pipe(int*);
|
|
int write(int, void*, int);
|
|
int read(int, void*, int);
|
|
int close(int);
|
|
int kill(int);
|
|
int exec(char*, char**); /* execve(path, argv, 0) */
|
|
int execve(char*, char**, char**);
|
|
int open(char*, int);
|
|
int mknod(char*, short, short);
|
|
int unlink(char*);
|
|
int fstat(int fd, struct stat*);
|
|
int link(char*, char*);
|
|
int mkdir(char*);
|
|
int chdir(char*);
|
|
int dup(int);
|
|
int dup2(int, int);
|
|
int fcntl(int, int, int);
|
|
long lseek(int, long, int);
|
|
int getpid(void);
|
|
char* sbrk(uint64);
|
|
int sleep(int);
|
|
int uptime(void);
|
|
int vga_sync(void*); // legacy no-op syscall; the name is ABI, not this layer
|
|
int getmouse(struct mouse_data*);
|
|
int reboot(void);
|
|
int shutdown(void);
|
|
int sigfillset(sigset_t *set);
|
|
int sigprocmask(int how, const sigset_t *set, sigset_t *oldset);
|
|
int sigwait(const sigset_t *set, int *sig);
|
|
int alarm(int seconds);
|
|
int waitpid(int pid, int *status, int options);
|
|
int setsid(void);
|
|
void* mmap(void*, uint64, int, int, int, uint64);
|
|
// Shared memory. shmat returns the attach address, or a small negative value
|
|
// on failure — there is no errno in this runtime, so check for < 0.
|
|
int shmget(int key, uint64 size, int flags);
|
|
void* shmat(int id, void *addr, int flags);
|
|
int shmdt(void *addr);
|
|
int munmap(void*, uint64);
|
|
int delete(char*);
|
|
int show(char*);
|
|
int showstat(char*, struct stat*);
|
|
int ftruncate(int, int);
|
|
int truncate(char*, int);
|
|
int rename(const char*, const char*);
|
|
int symlink(char*, char*);
|
|
int readlink(char*, char*, int);
|
|
int getuid(void);
|
|
int geteuid(void);
|
|
int nanosleep(void*);
|
|
int mprotect(void*, uint64, int);
|
|
int ioctl(int, uint64, void*);
|
|
// Declared at file scope, not inside the prototype: struct pollfd lives in
|
|
// posix.h, and a tag first seen in a parameter list is scoped to that list --
|
|
// so the prototype would describe a different, incompatible type.
|
|
struct pollfd;
|
|
int poll(struct pollfd*, int, int);
|
|
|
|
// Attributes on a file, and the index over them. Only SchFS carries these;
|
|
// anything else answers EOPNOTSUPP.
|
|
//
|
|
// schfs_query returns how many object ids it wrote, or -1 if the attribute has
|
|
// no index -- it will not fall back to walking the filesystem, because a query
|
|
// that silently becomes a full scan is worse than one that says it cannot help.
|
|
int setxattr(const char *path, const char *name, const void *val, int size,
|
|
int flags);
|
|
int getxattr(const char *path, const char *name, void *val, int size);
|
|
int removexattr(const char *path, const char *name);
|
|
int schfs_index(const char *name);
|
|
int schfs_query(const char *name, const char *value,
|
|
unsigned long long *out, int cap);
|
|
char* getcwd(char*, int);
|
|
int arch_prctl(int, uint64);
|
|
int set_tid_address(int*);
|
|
int set_robust_list(void*, int);
|
|
int futex(int*, int, int, void*, int*, int);
|
|
int clone(uint64, void*, void*, void*, void*);
|
|
void exit_group(int) __attribute__((noreturn));
|
|
int wait4(int, int*, int, void*);
|
|
int getgid(void);
|
|
int getegid(void);
|
|
int umask(int);
|
|
int writev(int, void*, int);
|
|
int readv(int, void*, int);
|
|
void* brk(void*);
|
|
int prlimit(int, int, void*, void*);
|
|
int lstat(const char*, struct stat*);
|
|
int access(const char*, int);
|
|
int openat(int, const char*, int, ...);
|
|
int fchdir(int);
|
|
int enable_linux_abi(void);
|
|
int getrlimit(int, void*);
|
|
int setuid(int);
|
|
int setgid(int);
|
|
int getsid(int);
|
|
int dup3(int, int, int);
|
|
int pipe2(int*, int);
|
|
int clock_gettime(int, void*);
|
|
int getppid(void);
|
|
int rt_sigaction(int, void*, void*, uint64);
|
|
int mount(const char *src, const char *tgt, const char *fstype, uint64 flags, void *data);
|
|
|
|
// Directory reading. The kernel has had getdents64 since the Linux ABI landed,
|
|
// but nothing declared it here, so first-party programs had no way to list a
|
|
// directory at all -- which is what schinit needs to find its job files.
|
|
//
|
|
// Records are packed: step by d_reclen, never by sizeof, because d_name is a
|
|
// flexible array and each record is only as long as its name needs.
|
|
struct dirent64 {
|
|
uint64 d_ino;
|
|
int64 d_off;
|
|
ushort d_reclen;
|
|
uchar d_type;
|
|
char d_name[];
|
|
};
|
|
#define DT_DIR 4
|
|
#define DT_REG 8
|
|
|
|
int getdents64(int fd, void *buf, int count);
|
|
|
|
// Sockets. `struct sockaddr` and the AF_*/SOCK_* constants are in socket.h;
|
|
// include it as well as this header to use them.
|
|
struct sockaddr;
|
|
int socket(int domain, int type, int protocol);
|
|
int bind(int fd, const struct sockaddr *addr, int addrlen);
|
|
int listen(int fd, int backlog);
|
|
int accept(int fd, struct sockaddr *addr, int *addrlen);
|
|
int accept4(int fd, struct sockaddr *addr, int *addrlen, int flags);
|
|
int connect(int fd, const struct sockaddr *addr, int addrlen);
|
|
int socketpair(int domain, int type, int protocol, int sv[2]);
|
|
int sendto(int fd, const void *buf, int len, int flags, const struct sockaddr*, int);
|
|
int recvfrom(int fd, void *buf, int len, int flags, struct sockaddr*, int*);
|
|
int sockshutdown(int fd, int how);
|
|
int setsockopt(int fd, int level, int opt, const void *val, int len);
|
|
int getsockopt(int fd, int level, int opt, void *val, int *len);
|
|
// The only calls that can move a descriptor between processes (SCM_RIGHTS).
|
|
struct msghdr;
|
|
int sendmsg(int fd, const struct msghdr *msg, int flags);
|
|
int recvmsg(int fd, struct msghdr *msg, int flags);
|
|
|
|
// --- ulib.c ---
|
|
int stat(const char*, struct stat*);
|
|
char* gets(char*, int max);
|
|
|
|
#endif // USER_H
|